Session Management is the secure coding practice that encompasses the entire lifecycle of a user's interaction with an application. This includes the secure generation of session identifiers using cryptographically strong, well-vetted random algorithms to prevent prediction. It also dictates that these identifiers must be protected and properly scoped. A critical component of session management is the secure termination of sessions, ensuring that when a user logs out, the session is fully invalidated on the server-side to prevent session hijacking or replay attacks. The three activities described in the question are core tenets of secure session management.

A. Output Encoding: This practice is used to prevent Cross-Site Scripting (XSS) by ensuring data sent to a client is safely rendered, not for managing session state.

B. Input Validation: This practice protects against injection-style attacks by sanitizing and validating all data received from a client before it is processed.

C. Access Control: This practice, also known as authorization, determines whether an authenticated user has the necessary permissions to perform an action or access a resource.

1. OWASP Session Management Cheat Sheet. The Open Web Application Security Project (OWASP).

Section: Session ID Properties: "Session ID must be unpredictable (random enough) to prevent guessing attacks, where an attacker is able to guess a valid session ID." This directly addresses the use of well-vetted algorithms for random identifiers.

Section: Session Logout and Timeout: "When the user logs out from the application, the server must invalidate the associated session on the server side as the main and authoritative action." This addresses the full termination of user processes on logout.

2. NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. National Institute of Standards and Technology.

Section 7.1, Session Management Requirements: "When a session is terminated, the RP [Relying Party] shall invalidate the session identifier such that it cannot be used again to gain access." This supports the requirement for proper session termination. The section also details requirements for session identifier generation and protection.

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 387-402. (A foundational paper often cited in university security courses).

Section I.A.3, Principle of Complete Mediation: While not explicitly about session management, the principle implies that every access must be checked. Secure session management is the mechanism that maintains the authenticated state between checks, and its proper termination is essential to revoking that state, ensuring mediation is not bypassed by a stale session.